Login Provider Flaw Lets Attacker Raid Keplr Crypto Wallets Set Up With Google or Apple

Some people who set up a Keplr crypto wallet using their Google or Apple account have had money stolen. Keplr uses a company called Web3Auth to run that sign-in. Both companies said late last week that the attacker used a security flaw at Web3Auth to reach the wallets. Keplr described it as a "private key breach" for some users. A private key is the secret code that approves payments, so whoever holds it can move the money.

Web3Auth said it used the attacker's own route to empty other at-risk wallets before the attacker got to them, moving the funds with the wallet maker's help into recovery wallets. An empty balance may therefore mean money was rescued, not stolen. Wallets made with a recovery phrase (a backup list of 12 or 24 words) or a hardware wallet are not affected. Keplr has paused Google and Apple sign-in while it investigates, and is working on a way for users to check whether they were affected. Web3Auth has published a recovery address list to help tell its own transfers from possibly malicious ones.

Many details remain unknown. Neither company has said how the flaw worked, when it was first used, or whether it is now closed. Keplr co-founder Josh Lee estimated about 20% of Google and Apple login accounts were affected, with only a fraction appearing exploited. Security firm GoPlus said at least about $1 million had been stolen, without explaining how it reached that figure.